Friday, 11 November 2011

Deploying an Active Directory Rights Management Services Licensing-only Cluster Step-by-Step Guide




Deploying an Active Directory Rights Management Services Licensing-only Cluster Step-by-Step Guide

Microsoft Corporation
Published: March 2008
Author: Brian Lich
Editor: Carolyn Eller
Abstract
This step-by-step guide provides instructions for setting up a test environment for creating and deploying an Active Directory Rights Management Services (AD RMS) licensing-only cluster on the Windows Server® 2008 operating system.


This document is provided for informational purposes only and Microsoft makes no warranties, either express or implied, in this document. Information in this document, including URL and other Internet Web site references, is subject to change without notice. The entire risk of the use or the results from the use of this document remains with the user. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 2008 Microsoft Corporation. All rights reserved.

Active Directory, Microsoft, MS-DOS, SQL Server, Vista, Windows, Windows NT, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

All other trademarks are property of their respective owners.




Contents

Deploying an Active Directory Rights Management Services Licensing-only Cluster Step-by-Step Guide 5
About This Guide 5
What This Guide Does Not Provide 5
Deploying an AD RMS Licensing-only Cluster in a Test Environment 6
Step 1: Setting up the CP&L Enterprises Domain 7
Add the AD RMS Licensing-only Cluster Server (CPANDL-ADRMSLIC) to the cpandl.com domain 8
Add the AD RMS licensing-only cluster database server (CPANDL-LICDB) to the cpandl.com domain 10
Step 2: Configuring the AD RMS Licensing-only Cluster 12
Step 3: Verifying AD RMS Functionality 14

Deploying an Active Directory Rights Management Services Licensing-only Cluster Step-by-Step Guide


About This Guide

This step-by-step walks you through the process of setting up a working licensing-only Active Directory Rights Management Services (AD RMS) cluster in a test environment. During this process you install a database server, install the AD RMS server role, configure the AD RMS licensing-only cluster, and configure the AD RMS-enabled client computer to acquire licenses from the licensing-only cluster.Note
For most purposes, we recommend that you add AD RMS servers to the root cluster so that you can set up redundancy and load balancing across all servers that are in your deployment. Although licensing-only clusters can also be used to offload the processing of licensing and publishing requests, a licensing-only cluster cannot be load balanced with the root cluster.
In this guide, you create a test deployment that includes the following components:
Two AD RMS servers
Two AD RMS database servers
AD RMS-enabled client
Active Directory domain controller
This guide assumes that you previously completed Windows Server Active Directory Rights Management Services Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=72134), and that you have already deployed the following components:
One AD RMS server
One AD RMS database server
AD RMS-enabled client
Active Directory domain controller

What This Guide Does Not Provide

This guide does not provide the following:
An overview of AD RMS. For more information about the advantages that AD RMS can bring to your organization, see http://go.microsoft.com/fwlink/?LinkId=84726.
Guidance for setting up and configuring AD RMS in a production environment
Complete technical reference for AD RMS

Deploying an AD RMS Licensing-only Cluster in a Test Environment

We recommend that you first use the steps provided in this guide in a test lab environment. Step-by-step guides are not necessarily meant to be used to deploy Windows Server features without additional deployment documentation and should be used with discretion as a stand-alone document.
Upon completion of this step-by-step guide, you will have a working AD RMS infrastructure with an AD RMS licensing-only cluster. You can then test and verify AD RMS functionality as follows:
Restrict permissions on a Microsoft Office Word 2007 document
Have an authorized user open and work with the document.
Have an unauthorized user attempt to open and work with the document.
Licensing-only clusters are optional and are most often deployed to address specific licensing requirements, such as supporting unique rights management requirements of a department. For instance, a group within your organization may require specific rights policy templates that no other department can access.
The test environment described in this guide includes six computers connected to a private network and using the following operating systems, applications, and services:
Computer NameOperating SystemApplications and Services
ADRMS-SRVWindows Server® 2008AD RMS, Internet Information Services (IIS) 7.0, World Wide Web Publishing Service, and Message Queuing
CPANDL-DCWindows Server 2008 or Windows Server 2003 with Service Pack 2 (SP2)Active Directory Domain Services or Active Directory®, Domain Name System (DNS)
ADRMS-DBWindows Server 2003 with SP2Microsoft SQL Server® 2005 Standard Edition with Service Pack 2 (SP2)
ADRMS-CLNTWindows Vista®Microsoft Office Word 2007 Enterprise Edition
CPANDL-ADRMSLICWindows Server 2008AD RMS, Internet Information Services (IIS) 7.0, World Wide Web Publishing Service, and Message Queuing
CPANDL-LICDBWindows Server 2003 with SP2Microsoft SQL Server® 2005 Standard Edition with Service Pack 2 (SP2)

Note
For more information about the system requirements for installing AD RMS, see http://go.microsoft.com/fwlink/?LinkId=84733.
The computers form a private intranet and are connected through a common hub or Layer 2 switch. This configuration can be emulated in a virtual server environment if desired. This step-by-step exercise uses private addresses throughout the test lab configuration. The private network ID 10.0.0.0/24 is used for the intranet. The domain controller is named CPANDL-DC for the domain named cpandl.com. The following figure shows the configuration of the test environment:

Step 1: Setting up the CP&L Enterprises Domain


Before you create the AD RMS licensing-only cluster, you need to configure and add two servers to the infrastructure of the CPANDL domain. In this step, you will perform the following tasks:
Add the AD RMS licensing-only cluster server (CPANDL-ADRMSLIC) to the cpandl.com domain
Add the AD RMS licensing-only cluster database server (CPANDL-LICDB) to the cpandl.com domain
This step assumes that you have completed the Windows Server Active Directory Rights Management Services Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=72134).
Use the following table as a reference when setting up the appropriate computer names, operating systems, and network settings that are required to complete the steps in this guide.Important
Before you configure your computers with static Internet Protocol (IP) addresses, we recommend that you first complete Windows product activation while each of your computers still has Internet connectivity. You should also install any available critical security updates from Windows Update (http://go.microsoft.com/fwlink/?LinkID=47290).
Computer nameOperating system requirementIP settingsDNS settings
CPANDL-ADRMSLICWindows Server 2008IP address:
10.0.0.7
Subnet mask:
255.255.255.0
Preferred:
10.0.0.1
CPANDL-LICDBWindows Server 2003 with Service Pack 2 (SP2)IP address:
10.0.0.8
Subnet mask:
255.255.255.0
Preferred:
10.0.0.1


Add the AD RMS Licensing-only Cluster Server (CPANDL-ADRMSLIC) to the cpandl.com domain

To configure the member server, CPANDL-ADRMSLIC, you must install Windows Server 2008, configure TCP/IP properties, and then join CPANDL-ADRMSLIC to the cpandl.com domain. You must also add the ADRMSADMIN account to the local administrators group so that an administrator can use the ADRMSADMIN account to install AD RMS on CPANDL-ADRMSLIC.
First, install Windows Server 2008 as a stand-alone server.To install Windows Server 2008
1. Start your computer by using the Windows Server 2008 product CD.
2. When prompted for a computer name, type CPANDL-ADRMSLIC.
3. Follow the rest of the instructions that appear on your screen to finish the installation.

Next, configure TCP/IP properties so that CPANDL-ADRMSLIC has a static IP address of 10.0.0.8. In addition, configure the DNS server by using the IP address of CPANDL-DC (10.0.0.1).To configure TCP/IP Properties
1. Log on to CPANDL-ADRMSLIC with the CPANDL-ADRMSLIC \Administrator account.
2. Click Start, click Control Panel, double-click Network and Sharing Center, click Manage Network Connections, right-click Local Area Connection, and then click Properties.
3. On the Networking tab, click Internet Protocol Version 4 (TCP/IPv4), and then click Properties.
4. Click the Use the following IP address option. In IP address, type 10.0.0.7. In Subnet mask, type 255.255.255.0.
5. Click the Use the following DNS server addresses option. In Preferred DNS server, type 10.0.0.1.
6. Click OK, and then click Close to close the Local Area Connection Properties dialog box.

Next, join CPANDL-ADRMSLIC to the cpandl.com domain.To join CPANDL-ADRMSLIC to the cpandl.com domain
1. Click Start, right-click Computer, and then click Properties.
2. Click Change settings (at the right side under Computer name, domain, and workgroup settings), and then click Change.
3. In the Computer Name/Domain Changes dialog box, click the Domain option, and then type cpandl.com.
4. Click More, and then type cpandl.com in Primary DNS suffix of this computer box.
5. Click OK, and then click OK again.
6. When a Computer Name/Domain Changes dialog box appears prompting you for administrative credentials, provide the credentials for CPANDL\Administrator, and then click OK.
7. When a Computer Name/Domain Changes dialog box appears welcoming you to the cpandl.com domain, click OK.
8. When a Computer Name/Domain Changes dialog box appears telling you that the computer must be restarted, click OK, and then click Close.
9. Click Restart Now.

After the computer has restarted, add ADRMSADMIN to the local administrators group on CPANDL-ADRMSLIC.To add ADRMSADMIN to the local administrators group
1. Log on to CPANDL-ADRMSLIC with the CPANDL\Administrator account.
2. Click Start, click Administrative Tools, and then click Computer Management.
3. Expand System Tools, expand Local User and Groups, and then click Groups.
4. Right-click Administrators, click Add to Group, click Add, type ADRMSADMIN in the Enter the object names to select (examples) box, and then click OK.
5. Click OK, and then close Computer Management.

Add the AD RMS licensing-only cluster database server (CPANDL-LICDB) to the cpandl.com domain

To configure the member server, CPANDL-LICDB, you must install Windows Server 2003, configure TCP/IP properties, and then join CPANDL-LICDB to the cpandl.com domain. You must also add the ADRMSADMIN account to the local administrators group, so that an administrator can use the ADRMSADMIN account to install AD RMS licensing-only databases on CPANDL-LICDB.
First, install Windows Server 2003 on the computer that will be hosting the AD RMS licensing-only cluster databases.To install Windows Server 2003 Standard Edition
1. Start your computer using the Windows Server 2003 product CD.
2. Follow the instructions that appear on your computer screen, and when prompted for a computer name, type CPANDL-LICDB.
3. Follow the rest of the instructions that appear on your screen to finish the installation.

In this step, configure TCP/IP properties so that CPANDL-LICDB has a static IP address of 10.0.0.8To configure TCP/IP properties on CPANDL-LICDB
1. Log on to CPANDL-LICDB with the CPANDL-LICDB\Administrator.
2. Click Start, point to Control Panel, point to Network Connections, click Local Area Connection, and then click Properties.
3. On the General tab, click Internet Protocol (TCP/IP), and then click Properties.
4. Click the Use the following IP address option. In the IP address box, type 10.0.0.9. In the Subnet mask box, type 255.255.255.0.
5. Click OK, and then click Close to close the Local Area Connection Properties dialog box.

Next, join the AD RMS licensing-only cluster database server (CPANDL-LICDB) computer to the CPANDL domain:To join ADRMS-DB to the CPANDL domain
1. Click Start, right-click My Computer, and then click Properties.
2. Click Computer Name tab, and then click Change.
3. In the Computer Name Changes dialog box, select the Domain option, and then type cpandl.com.
4. Click More, and then type cpandl.com in the Primary DNS suffix of this computer box.
5. Click OK twice.
6. When a Computer Name Changes dialog box appears prompting you for administrative credentials, provide the credentials for CPANDL\Administrator, and then click OK.
7. When a Computer Name Changes dialog box appears welcoming you to the cpandl.com domain, click OK.
8. When a Computer Name Changes dialog box appears telling you that the computer must be restarted, click OK, and then click OK again.
9. Click Yes to restart the computer.

Next, install Microsoft SQL Server 2005 Standard Edition:To install Microsoft SQL Server 2005
1. Log on to CPANDL-LICDB with the CPANDL\Administrator account or another user account in the local Administrators group.
2. Insert the Microsoft SQL Server 2005 product CD. The installation will start automatically.
3. Click the I accept the licensing terms and conditions check box, and then click Next.
4. On the Installing Prerequisites page, click Install.
5. Click Next.
6. On the Welcome to the Microsoft SQL Server Installation Wizard page, click Next, and then click Next again.
7. In the Name box, type your name. In the Company box, type the name of your organization, and then type in the appropriate product key. Click Next.
8. Select the SQL Server Database Services check box and the Workstation components, Books Online, and development tools check box, and then click Next.
9. Click the Default instance option, and then click Next.
10. Click the Use the built-in System account option, and then click Next.
11. Click the Windows Authentication Mode option, and then click Next.
12. Click Next, accepting the default Collation Settings, and then click Next again.
13. Click Install. When the status of all the selected components is finished, click Next.
14. Click Finish.

Next, add ADRMSADMIN to the local Administrators group on CPANDL-LICDB. The administrator installing the AD RMS licensing-only cluster needs this membership in order to create the AD RMS licensing-only cluster databases. After AD RMS is installed, ADRMSADMIN can be removed from this group.To add ADRMSADMIN to local Administrators group
1. Click Start, point to Administrative Tools, and then click Computer Management.
2. Expand System Tools, expand Local Users and Groups, and then click Groups.
3. Right-click Administrators, click Add to Group, click Add, type ADRMSADMIN in the Enter the object names to select (examples) box, and then click OK.
4. Click OK, and then close Computer Management.


Step 2: Configuring the AD RMS Licensing-only Cluster


AD RMS is included with Windows Server 2008 and you install it as a server role by using Server Manager. Both installation and configuration of an AD RMS licensing-only cluster are handled through Server Manager. An AD RMS licensing-only cluster is composed of one or more AD RMS licensing-only servers configured in a load-balancing environment. This step-by-step guide will install and configure a single-server AD RMS licensing-only cluster.
Configure AD RMS as a licensing-only cluster.To add the AD RMS Server Role
1. Log on to CPANDL-ADRMSLIC as cpandl\ADRMSADMIN.
2. Click Start, point to Administrative Tools, and then click Server Manager.
3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
4. In the Roles Summary box, click Add Roles.
5. Read the Before You Begin page, and then click Next.
6. On the Select Server Roles page, select the Active Directory Rights Management Services check box.
7. The Add Roles Wizard appears informing you of the AD RMS dependent role services and features. Make sure that Web Server (IIS), Windows Process Activation Service (WPAS), and Message Queuing are listed, and then click Add Required Role Services. Click Next.
8. Read the AD RMS introduction page, and then click Next.
9. On the Select Role Services page, verify that the Active Directory Rights Management Server check box is selected, and then click Next.
10. Click the Create a new AD RMS cluster option, and then click Next.
11. Click the Use a different database server option.
12. Click Select, type CPANDL-LICDB in the Select Computer dialog box, and then click OK.
13. In Database Instance box, click the arrow, click Default, and then click Validate.
14. Click Next.
15. Click Specify, type CPANDL\ADRMSSRVC, type the password for the account, click OK, and then click Next.
16. Ensure that the Use AD RMS centrally managed key storage option is selected, and then click Next.
17. Type a strong password in the Password box and in the Confirm password box, and then click Next.
18. Choose the Web site where AD RMS will be installed, and then click Next. In an installation that uses default settings, the only available Web site should be Default Web Site.
19. Click the Use an SSL-encrypted connection (https://) option.
20. In the Fully-Qualified Domain Name box, type cpandl-adrmslic.cpandl.com, and then click Validate. If validation succeeds, the Next button becomes available. Click Next.
21. Click the Choose an existing certificate for SSL encryption option, click the certificate that has been imported for this AD RMS cluster, and then click Next.
22. Type a name that will help you identify the AD RMS cluster in the Friendly name box, and then click Next.
23. Read the Introduction to Web Server (IIS) page, and then click Next.
24. Keep the Web server default check box selections, and then click Next.
25. Click Install to provision AD RMS on the computer. It can take up to 60 minutes to complete the installation.
26. Click Close.
27. Log off the server, and then log on again as cpandl\ADRMSADMIN to update the security token of the logged-on user account. The user account that is logged on when the AD RMS server role is installed is automatically made a member of the AD RMS Enterprise Administrators local group. A user must be a member of that group to administer AD RMS.
*Note
At this point in the guide, you can remove cpandl\ADRMSADMIN from the local Administrators group on CPANDL-LICDB.
After the AD RMS licensing-only cluster is installed and configured, you must direct your AD RMS-enabled clients to use it by configuring a client registry override.To configure the AD RMS client registry override
1. Log on to ADRMS-CLNT as Administrator (cpandl\Administrator).
2. Click Start, in the Start Search box type regedit.exe, and then press ENTER.
3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
4. Navigate to:
HKEY_LOCAL_MACHINE\Software\Microsoft\MSDRM\ServiceLocation
If any parts of this path do not exist, you must create them.
5. Right-click ServiceLocation, point to New, and then click Key.
6. Type EnterprisePublishing, and then click OK.
7. Double-click the (Default) registry entry in the EnterprisePublishing key. In the Value data box type https://cpandl-adrmslic.cpandl.com:443/_wmcs/licensing, and then click OK.


Step 3: Verifying AD RMS Functionality


The AD RMS client is included in the default installation of Windows Vista and Windows Server 2008. Previous versions of the client are available for download for some earlier versions of the Windows operating system. For more information, see the Windows Server 2003 Rights Management Services page on the Microsoft Windows Server TechCenter (http://go.microsoft.com/fwlink/?LinkId=68637).
Before you can consume rights-protected content, you must add the AD RMS cluster URL and the AD RMS licensing-only cluster URL to the Local Intranet security zone for all users who will be consuming rights-protected content. To add AD RMS cluster to Local Intranet security zone
1. Log on to ADRMS-CLNT as Nicole Holliday (cpandl\NHOLLIDA).
2. Click Start, click All Programs, and then click Internet Explorer.
3. Click Tools, and then click Internet Options.
4. Click the Security tab, click Local intranet, and then click Sites.
5. Click Advanced.
6. In the Add this website to the zone box, type https://adrms-srv.cpandl.com, and then click Add.
7. In the Add this website to the zone box, type https://cpandl-adrmslic.cpandl.com, and then click Add.
8. Click Close, and then click OK twice.
9. Repeat steps 1–8 for Stuart Railson and Limor Henig.

To verify the functionality of the AD RMS deployment, you log on as Nicole Holliday and then restrict permissions on a Microsoft Word 2007 document so that members of the CP&L Engineering group are able to read the document but unable to change, print, or copy. You then log on as Stuart Railson, verifying that the proper permission to read the document has been granted, and nothing else. Then, you log on as Limor Henig. Since Limor is not a member of the Engineering group, he should not be able to consume the rights-protected file.To restrict permissions on a Microsoft Word document
1. Log on to ADRMS-CLNT as Nicole Holliday (cpandl\NHOLLIDA).
2. Click Start, point to All Programs, point to Microsoft Office, and then click Microsoft Office Word 2007.
3. Type CP&L engineering employees can read this document, but they cannot change, print, or copy it on the blank document page.
4. Click the Microsoft Office Button, click Prepare, click Restrict Permission, and then click Restricted Access.
5. Click the Restrict permission to this document check box.
6. In the Read box, type engineering@cpandl.com, and then click OK to close the Permission dialog box.
7. Click the Microsoft Office Button, click Save As, and then save the file as \\ADRMS-DB\Public\ADRMS-TST.docx.
8. Log off as Nicole Holliday.

Next, log on as Stuart Railson and open the document, ADRMS-TST.docx.To view a rights-protected document
1. Log on to ADRMS-CLNT as Stuart Railson (cpandl\SRAILSON).
2. Click Start, point to All Programs, point to Microsoft Office, and then click Microsoft Office Word 2007.
3. Click the Microsoft Office Button, and then click Open.
4. In the File name box, type \\ADRMS-DB \Public\ADRMS-TST.docx, and then click Open.
The following message appears: "Permission to this document is currently restricted. Microsoft Office must connect to https://cpandl-licadrms.cpandl.com:443/_wmcs/licensing to verify your credentials and download your permission."
5. Click OK.
The following message appears: "Verifying your credentials for opening content with restricted permissions…".
6. When the document opens, click the Microsoft Office Button. Notice that the Print option is not available.
7. Close Microsoft Word.
8. Log off as Stuart Railson.

Finally, log on as Limor Henig and verify that he is not able to consume the rights-protected file.To attempt to view a rights-protected document
1. Log on to ADRMS-CLNT as Limor Henig (cpandl\LHENIG).
2. Click Start, point to All Programs, point to Microsoft Office, and then click Microsoft Office Word 2007.
3. Click the Microsoft Office Button, and then click Open.
4. In the File name box, type \\ADRMS-DB\Public\ADRMS-TST.docx, and then click Open.
The following message appears: "Permission to this document is currently restricted. Microsoft Office must connect to https://cpandl-licadrms.cpandl.com:443/_wmcs/licensing to verify your credentials and download your permission."
5. Click OK.
6. The following message appears: "You do not have credentials that allow you to open this document. You can request updated permission from nhollida@cpandl.com. Do you want to request updated permission?"
7. Click No, and then close Microsoft Word.

You have successfully deployed and demonstrated the functionality of an AD RMS licensing-only cluster, using the simple scenario of applying restricted permissions to a Microsoft Word 2007 document.

No comments: